Sue
March 23rd, 2002, 3:16pm
This worm is a variation on the original Mylife worm sent earlier this month.
Besides e-mailing copies of itself to everyone included in the Windows address book, the new version includes a caricature of Bill Clinton playing a saxophone with a bra hanging out. It also executes its file-destroying payload whenever an infected computer is rebooted in an hour divisible by 8, such as 8:00 or 16:00. Because of its destructiveness and ability to send mass e-mail, MyLife.b ranks as a 7 on the ZDNet Virus Meter.
http://go.msn.com/nl/135561.asp
MyLife.B arrives as e-mail with the subject line "bill caricature." The body text reads as follows:
Hiiiii
How are youuuuuuuu?
look to bill caricature it's vvvery verrrry
ffffunny :-) :-)
i promise you will love it? ok
buy
========No Viruse Found========
MCAFEE.COM
The attached file is cari.scr.
If a user opens the attached file, MyLife will display a caricature of Bill Clinton playing a saxophone with a bra hanging out of it. The worm will then modify the system registry to run at star-tup by altering this setting:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "win" = "%SysDir%\cari.scr"
MyLife.b will attempt to e-mail copies of itself to everyone listed in the Windows address book. Upon rebooting the computer, the worm will delete files with the SYS extension in the Windows directory, and VXD, SYS, OCX, and NLS extensions in the Windows System directory. It will also try to delete all files in the C:, D:, E:, and F: drives, if they exist. The file deletions work only if the current hour in the system is divisable by 8.
Besides e-mailing copies of itself to everyone included in the Windows address book, the new version includes a caricature of Bill Clinton playing a saxophone with a bra hanging out. It also executes its file-destroying payload whenever an infected computer is rebooted in an hour divisible by 8, such as 8:00 or 16:00. Because of its destructiveness and ability to send mass e-mail, MyLife.b ranks as a 7 on the ZDNet Virus Meter.
http://go.msn.com/nl/135561.asp
MyLife.B arrives as e-mail with the subject line "bill caricature." The body text reads as follows:
Hiiiii
How are youuuuuuuu?
look to bill caricature it's vvvery verrrry
ffffunny :-) :-)
i promise you will love it? ok
buy
========No Viruse Found========
MCAFEE.COM
The attached file is cari.scr.
If a user opens the attached file, MyLife will display a caricature of Bill Clinton playing a saxophone with a bra hanging out of it. The worm will then modify the system registry to run at star-tup by altering this setting:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "win" = "%SysDir%\cari.scr"
MyLife.b will attempt to e-mail copies of itself to everyone listed in the Windows address book. Upon rebooting the computer, the worm will delete files with the SYS extension in the Windows directory, and VXD, SYS, OCX, and NLS extensions in the Windows System directory. It will also try to delete all files in the C:, D:, E:, and F: drives, if they exist. The file deletions work only if the current hour in the system is divisable by 8.